CVE-2006-0200

PHP 5.1.0-5.1.1 - Remote Code Execution via MySQL Error Message Format String Specifiers

Title source: llm

Description

Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.

References (10)

Core 10

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1015485

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18431

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/0369

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/0177

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/421705/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/24095

Vendor Advisory x_refsource_misc

http://www.hardened-php.net/advisory_022006.113.html

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/337

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/16219

Patch x_refsource_confirm

http://www.php.net/release_5_1_2.php

Scores

EPSS 0.1236

EPSS Percentile 94.0%

Details

CWE

CWE-134

Status published

Products (2)

php/php 5.1.0

php/php 5.1.1

Published Jan 13, 2006

Tracked Since Feb 18, 2026